General

  • Target

    RNSM00389.7z

  • Size

    2.8MB

  • Sample

    241103-1j3w3axqdp

  • MD5

    f5c991a3d250ecc71b370ae5281d6ff5

  • SHA1

    bec5ccea4fd07f48e413d89fe4577f3d51375fab

  • SHA256

    99b64aab9a8117d18911876cb4aa710b8b86a7b80c83829bd3d7ce1083d5753b

  • SHA512

    e58f269befdd28fd3f4cd8b91c1f636fdbb49d2abf850e3fca9d7660807c8b4b26bb00b49c1fc7cea8f9c4c707610b222035a003cf812e93c9d62cb4745b5b1c

  • SSDEEP

    49152:27pM4uXr78dzJ4kauQWaD2TJECeTzWQMMt4l98QykWZJIP0POZuvr7p:ypMPXr7sJta2Z2ZvbMMml98/J8022l

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$QV..IaQ6B9QV724W3myufeRDO8uuVgVqGSa6eDWdTrsJ1a32XBdh.

Campaign

4402

Decoy

employeesurveys.com

izzi360.com

centromarysalud.com

coding-machine.com

schutting-info.nl

ceid.info.tr

eglectonk.online

tulsawaterheaterinstallation.com

rumahminangberdaya.com

buroludo.nl

labobit.it

steampluscarpetandfloors.com

andersongilmour.co.uk

satyayoga.de

sotsioloogia.ee

oceanastudios.com

cactusthebrand.com

danielblum.info

cursoporcelanatoliquido.online

stefanpasch.me

Attributes
  • net

    true

  • pid

    $2a$10$QV..IaQ6B9QV724W3myufeRDO8uuVgVqGSa6eDWdTrsJ1a32XBdh.

  • prc

    firefox

    sql

    outlook

    ocomm

    dbeng50

    ocautoupds

    mydesktopservice

    sqbcoreservice

    steam

    thebat

    isqlplussvc

    oracle

    onenote

    mydesktopqos

    tbirdconfig

    visio

    msaccess

    excel

    synctime

    xfssvccon

    thunderbird

    wordpad

    dbsnmp

    powerpnt

    infopath

    mspub

    agntsvc

    winword

    ocssd

    encsvc

  • ransom_oneliner

    Soon you may lose your files FOREVER Find: "readme-{EXT}-NOW.txt" in folders or on your desktop! YOU HAVE A FEW DAYS OR A FILE WILL BE LOST FOREVER !!!

  • ransom_template

    Your files are locked due to a vulnerability in your system by "{EXT}" extension. You will not be able to decrypt the files yourself, in the worst case you can destroy the data irreversibly. The only way to unlock your data is to buy the decryption program. Go to the link written below to more details. If you cannot do this yourself, find a data recovery company in internet. They cannot help you unlock your data, because only we have decryption key, but will help you make a payment and provide you guarantees. ATTENTION! DATA RECOVERY AGENCIES WORK AND DURING THE CORONOVIRUS QUARANTINE, THEY WILL HELP YOU REMOTE. Also, I ask you to note, you have no long time, if you do not make payment soon, the price for the decryptor will double. So I recommend you dont waste time and move! Go to the page through the browser: http://decryptor.cc/{UID} If your site does not open, then download the "TOR Browser" (https://torproject.org/). If you cannot access the download page of the "TOR Browser", then download the VPN! After installing "TOR Browser", open it and follow the link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} After going to the site, enter the following code: {KEY}

  • sub

    4402

  • svc

    svc$

    mepocs

    memtas

    backup

    sql

    veeam

    vss

    sophos

Extracted

Family

sodinokibi

Botnet

$2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu

Campaign

51

Decoy

woodleyacademy.org

bookspeopleplaces.com

despedidascostablanca.es

lapinvihreat.fi

drfoyle.com

carolinepenn.com

abuelos.com

groupe-frayssinet.fr

tecnojobsnet.com

deoudedorpskernnoordwijk.nl

siluet-decor.ru

smessier.com

calxplus.eu

julis-lsa.de

aminaboutique247.com

pier40forall.org

coding-machine.com

longislandelderlaw.com

expandet.dk

blogdecachorros.com

Attributes
  • net

    true

  • pid

    $2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu

  • prc

    mysql

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    51

  • svc

    backup

    sql

    svc$

    mepocs

    vss

    memtas

    sophos

    veeam

Extracted

Family

modiloader

C2

https://drive.google.com/u/0/uc?id=1BKqO_YkUPGwRKT_vzYTj7zx1s5xlp4SU&export=download

Extracted

Path

C:\Program Files (x86)\Microsoft\Edge\Application\D36D2C-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .d36d2c -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and loosing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_d36d2c: j4RWPhbOwBMdJF1g9iZDdISHWipFTj1OTsMuJBQhffGKqeIU8O FwS3ljHGvWfPRcZ4B+v1BxL06eNVCtQsFK+3F1ANWwhGg+urP5 y+QsbdOOk54zhCUqPFYtMX/h1jozEnRiw2HmacUxL4lXWzCn0C OU6f71BijhGo7SbzZ3TPD2jGcQmjEKPGNSnDOdhTg4ADmB2AiD agB4CcyunkJZxXKJIQnMv4rAF0lgGmdXSC4mu2O42AjP158Ha5 rpV+QjES/jeDCCF974Upza6xEdzVZ5nla+pezxSQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Users\readme-7108z-NOW.txt

Ransom Note
Your files are locked due to a vulnerability in your system by "7108z" extension. You will not be able to decrypt the files yourself, in the worst case you can destroy the data irreversibly. The only way to unlock your data is to buy the decryption program. Go to the link written below to more details. If you cannot do this yourself, find a data recovery company in internet. They cannot help you unlock your data, because only we have decryption key, but will help you make a payment and provide you guarantees. ATTENTION! DATA RECOVERY AGENCIES WORK AND DURING THE CORONOVIRUS QUARANTINE, THEY WILL HELP YOU REMOTE. Also, I ask you to note, you have no long time, if you do not make payment soon, the price for the decryptor will double. So I recommend you dont waste time and move! Go to the page through the browser: http://decryptor.cc/ACFBC0BCBA746B0F If your site does not open, then download the "TOR Browser" (https://torproject.org/). If you cannot access the download page of the "TOR Browser", then download the VPN! After installing "TOR Browser", open it and follow the link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ACFBC0BCBA746B0F After going to the site, enter the following code: Zqghz1KzWFC+Abzz8rIjig6/pu4Kpx5oONxYpnvZp23uYq/zijyvLG8OXE9YEtW1 o9+/Cy43DF1Yjk43Sg2cyN+iweFC4H8OHuNbP0DnIk04SYtgBLlRy+wtAXV2dnPq 4m6dtC8ryrKXDG6Mu/M2smOcUWvcp3P/6L79vgcwDIUcMEddTQzypE7JlWPJ6QjV shXIFMcFpFZ+HRaLzewgFgKVEUER2NQL5CTAalD92PTkp7kPTuVMqOj7x2hLQLNN S2tHUsn+T9rMWX6zGKcHZQ2eMcUEppKdh1p00O9JxYMXF8TDM8gDm1c6t5eeAuDX 40b1XngKGIJnA7TCXj6d2terWZD8VU/h1CJpZZq11rZWyxkGU0ZPBWpcD2vOL+EE RU6b1OKrS7PljZpIiRtj3wSBO3ATrR1w8TOARUBv8zadJaEjSAs/Q4Fnk87lIvpi wNFhW5fdcOlky+OaWyW5aYHgdpRehBuHQgzFsWPyJWf+CyYx2/gC+WJiEsapGx2A fm43iN14ebiKiKEA9WXTFz1KQmwnotPJlsj8HLk/HeYp+faVty8b4JowKSFt4b0w LEEypZdCc3oXS2yOWu31eOzOMy7NkOanVK5HE/Xm2AjUTy0iuCfiozLxswnuFTjk iUaDPGtv8Wc0lgjoPNOwaQ3vaGnlBsGH/byBu7iOBc9uaOAwxXlOwJ70ZxdkTno0 6dVUb3dXf3v8i6gxbHmGBI4QceXLKDsWxy08F6fgPN4i7tCiGEWFsIbbhK+yguid FLItZTApYYzaAChNPas1mWqXM9rRQQKiNex0g53VNwDBPlknNvDw6hIP85xNRU/u nvaz1sB0i6vOwFoJEmBRC7FS+tEfZ1JIE2R4xqB+micF0XVEzvW7aar9jy8a3lFH s4c+Rssqe7FqQLgms2fCZ/3EoY198wf0pKgI8mxg5kOD50Pjnv1QkiAQvKBZVXDo 26g7iIMbqZ7r4e17aIWtau0SaEf8jAipoTHAlfa5lkOopGzjpYcd7iLpK7xEkj3v vPsdnbN/pDfyh6JvYCOBPaUrmZFFqJ2ERyJZ+14+pDKXFped571JenizZDZpRkN6 W9O7Q7NNWgr+ygZxLarhl9nnWU1o66RyilZi8zZ4KA7R+RhB0hg9dawWmYPQRjU8 lM6J2ph5LnMQo0UzGx1i8ZDQUfW9HqDv78z27tPpHOkDOdiP/lqp0hilOzoaKr+z gYsoFvIMlUDXXlzGdNI37mo/+jLjgu3tlERIBFo1/fw1CwwIy6ubEqgFHZko4+f9 T+NFFriAp7hREzwtg+0v9tTy/wEShMuUcF9ICWhwedD+1gqr79j7XVuPTbXBVcTd FW+fNMm4auAjA+zea6fHPxebk1FP+P4UqQNQn6XZaFkujjPR
URLs

http://decryptor.cc/ACFBC0BCBA746B0F

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ACFBC0BCBA746B0F

Extracted

Path

C:\Users\7sie9qr-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 7sie9qr. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ACFBC0BCBA746B0F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/ACFBC0BCBA746B0F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: s4vjUYXFWa3vEBQH6xN6NwSxAwn04iPUMQwMYyUcW3/m3ZrkIaqFnS8qpbBxju1Z xIk48PzsaEAXzux4p/gsoZ6mZElrLP9JkPcFt3oGNa4lCy2DoJpqJCqBBzy8EHpt Ob7Hy0WCdJYAsve4tehQENqw74frAdQ/AqZ081cL2j0b757Mv/HGj+WZP2QYbmXW VtKUNuMBbF/mp7V88JTfdF+OBTK++QUruDjnD9twsCYJR2X4sZZVsqxQE7Q1is0r 0hpkKg4/vqApH1pyk+aRAFq0ldO6pw4/nF0R2uyXUW/w9XTrxmurExB4KHwwi/4k hQ9HAbEG+eYRDVT2m5F5MH4PQvzghe6GjJ9n/h0AG+/8NOUTDmXGiHOXWLEi/6uh jcDtw77A+zPlHvFwZcTpLX71qwhR5/c7eaHAfDePEiUyHbuduDyqf7PpIz9gxBbl Rl4INWUnvJfcxiWNv2kTMJX5mxr6h34OB0MUdR3BLuXWK0aVWkr3eYQsd9xxjzDf 2FsFCy9RpPBi9GY3H7rX4c6pg+i8byvyU6wRyoe3ur4EJKyVGF3DS2Ane6SmHvok po9+xgm6AG91yWGPumLm+y7QQDsyYj5vxnK7+jevpGYCL03RqbUVraBHdEcf2tK2 x63nByPck1pqKoJHJGG/8Njf6kxw5Ydg4rjwOCnjh5Lhl7pxzQ3jIK7DJLqBbgUO 6efTO+LfG+kHCCOU6VfD2inSiMmhky+Cr4XFFiLf4FWh+edwDvZSpJfQ2ZWsa2uU YPbOCyIgqUkTlZGbMgs01Ljpl2QuIb9Vsl8NAn3AMRx58992g39bRKv/YxkvS5ta aMHYqBcpXrExZZx3FV2rTKT4Tc1LXtDgxSYP5K44S/rryHcFZOx+WUlzYckMkXVY hdJvKHPSndnvSCxwEdu/99nPWBCb7wx1cArBwEChyhEJchw5YurD2lzUUvcabmzd yzSmDpqyT9U4wnwku/YTOEHXWHMe7k3wszZ/ecU5sUOZhUYIiEmL2iGer3WEzfbS U4xR8BYkRBRzzoIVyy4WS8wZpMZxMvetih/KU6sNLQjakBzoRoL5tbVAIqaivgXI Jo7NaTDu8d46ixYw26zsjITF9arnS1EiXNDJMNnzTEjE5RSrQFs2biNAKdhn68nX TFVXN9JM8eOdZmzx5CM4z9SzVxSrrTFiavhrL56EfBjGfC90Jyp2Ap8BasKiPrlS dbzjdk3AbngLRuMTDC6wojbh0qgi31308FI6j8x+WI5tpnOhStxhE0O/00KBE1ZW VF2Sbdr++B3h2e0Q81Ndmi/1jD8ZWGhJuY5gb/rxG10dbz6sJRyRjPUhJ0/sGY0M yniwEJD5/69qbDiG2IqQWuF/c+SNVjal02FO1nu9fAQYJST4 Extension name: 7sie9qr ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ACFBC0BCBA746B0F

http://decryptor.cc/ACFBC0BCBA746B0F

Targets

MITRE ATT&CK Enterprise v15

Tasks